1. Field of the Invention
This invention relates to an improved system for detecting sensor faults in systems which rely on sensors for monitoring and control purposes. An example of this is the detection of faults in sensors used to control gas turbine engines.
2. Discussion of Prior Art
Sensors which measure gas turbine engine parameters have been shown to be one of the most fault prone components in such engine control systems. Attempts to improve sensor integrity have concentrated on maintaining correct sensor readings, even in the event of one or more sensor faults. It is known in the art to overcome the problem of sensor faults by doubling or even trebling the number of sensors. This duplication of components is referred to as "hardware redundancy", which means that if a fault arises in one of the sensors, its presence is indicated by virtue of the two sensor signals being dissimilar. Although this method is widely used, it is not only costly, but more importantly in aerospace applications, results in extra weight of the sensors and associated electronics.
To avoid these disadvantages, "analytical redundancy" has been studied as a means of reducing the number of sensors whilst still retaining the required degree of integrity. Analytical redundancy detects the presence of a sensor fault by comparing the sensor reading with a reference signal provided by a software model for example, rather than from a duplicate sensor. Such software models must accurately follow the characteristics of the system being monitored or controlled, and must be able to run in real time. Most model-based systems use some sort of observer or Kalman filter to continuously correct the reference states, using information from the engine sensors, such that they mirror the actual outputs.
Once the reference outputs are obtained they are subtracted from the actual sensor outputs. The difference between these two signals is often referred to as the residual signal. In prior art fault detection systems which use this method, a fault is declared if the residual exceeds a prescribed threshold value; if no faults are present, the residual signal would ideally be zero.
In most applications, however, it is impossible to obtain a model of a complicated system such as a gas turbine engine which can run in real time and which still matches the system sensor outputs over the system's entire operating range. This is especially true when sensor noise is taken into consideration. Filtering can help reduce noise but will not entirely eliminate it. In practice, therefore, allowance must be made for the fact that the amplitude of the reference outputs will always be different from the amplitude of the sensor outputs.
Methods which only compare the amplitude of the engine and reference outputs are very susceptible to modelling errors. When a system is in steady state, modelling errors will cause d.c. biases between the system and reference outputs. These biases will not only vary under different operating conditions of the engine but also between different systems of the same type. Prior art fault detection systems which compare the difference in amplitudes between system and reference outputs generate residual signals which are at least as large as these d.c. biases and so the fault detection thresholds have to be increased accordingly. This in turn means that only faults which are larger than these d.c. biases can be detected. Another problem is that the dynamic modelling errors are usually larger than the steady state errors. This means that during engine manoeuvres where the engine state is changing rapidly, the sensor fault detection thresholds have to be increased. Because of these problems it has been difficult to determine effective threshold values which allow differences in signals due to small faults to be distinguished from those arising from modelling errors, noise and d.c. biases. This often results in sensor faults being wrongly declared. Practical application of the above techniques has therefore been largely confined to the detection of large, catastrophic faults.
UK patent application GB 212156A describes a method for detecting errors in a control system by comparing model and actual outputs from the system . Error signals above a pre-set deadband are integrated and a fault signal is generated if the integral exceeds a pre-set value. The integral is set to zero when the discrepency dissappears. Although this helps to show slow incipient errors, problems remain. Firstly one has to choose the appropriate deadband which is often a "hit or miss" exercise because many modelling errors or d.c. biases which may occur are indeterminate, especially when one considers that each sensor is different. Another problem concerns scaling; both reference and actual signals have to be of the same scale otherwise the integral method will always register a fault.
The problem with such systems are that when the system is running at as steady state, the only characteristics of the sensor and artificial reference signals will be due to noise which will be different for both signals, often causing a faults to be erroneously indicated.